Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Information Exposure Through Browser Caching
--------------------------------------------

N B Sri Harsha has discovered that the cached copies of pages visited in
Revive Adserver's Admin UI were still reachable via the browser history after
succesfully logging out. That could potentially expose sensitive information to
unauthorised parties.

CWE: CWE-525
CVSSv2: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
  • Loading branch information
mbeccati committed Oct 6, 2015
1 parent ccbd1cc commit 15aac36
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 4 deletions.
4 changes: 2 additions & 2 deletions lib/max/Delivery/common.php
Original file line number Diff line number Diff line change
Expand Up @@ -221,8 +221,8 @@ function MAX_commonSendContentTypeHeader($type = 'text/html', $charset = null)
function MAX_commonSetNoCacheHeaders()
{
MAX_header('Pragma: no-cache');
MAX_header('Cache-Control: private, max-age=0, no-cache');
MAX_header('Expires: Mon, 26 Jul 1997 05:00:00 GMT');
MAX_header('Cache-Control: no-cache, no-store, must-revalidate');
MAX_header('Expires: 0');

// Also send default CORS headers
MAX_header('Access-Control-Allow-Origin: *');
Expand Down
5 changes: 5 additions & 0 deletions www/admin/config.php
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,11 @@ function OA_Start($checkRedirectFunc = null)
$conf = $GLOBALS['_MAX']['CONF'];
global $session;

// Send no cache headers
MAX_header('Pragma: no-cache');
MAX_header('Cache-Control: no-cache, no-store, must-revalidate');
MAX_header('Expires: 0');

// XXX: Why not try loading session data when OpenX is not installed?
//if ($conf['openads']['installed'])
if (OA_INSTALLATION_STATUS == OA_INSTALLATION_STATUS_INSTALLED)
Expand Down
2 changes: 0 additions & 2 deletions www/admin/stats.php
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@
require_once MAX_PATH . '/lib/OA/Admin/Statistics/Factory.php';
require_once MAX_PATH . '/lib/pear/Date.php';

// No cache
MAX_commonSetNoCacheHeaders();

// The URL for stats pages may include values for "period_preset",
// "period_start" and "period_end". However, the user may have
Expand Down

0 comments on commit 15aac36

Please sign in to comment.